Nagios XI 5.2.6-5.4.12 - Chained Remote Code Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Nagios XI Chained Remote Code Execution', 'Description' = %q This module exploits a few different vulnerabilities in Nagios XI 5.2.6-5.4.12 to ga...

Nagios XI Chained Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Nagios XI Chained Remote Code Execution', 'Description' = %q This module exploits a few different vulnerabilities in Nagios XI 5.2.6-5.4.12 to ga...

Remote code execution

VMware ESXi 6.5 before ESXi650-201710401-BG, Workstation 12.x before 12.5.8, and Fusion 8.x before 8.5.9 contain a vulnerability that could allow an authenticated VNC session to cause a heap overflow via a specific set of VNC packets resulting in heap corruption. Successful exploitation of this...

CVE-2017-4941

VMware ESXi 6.0 before ESXi600-201711101-SG, 5.5 ESXi550-201709101-SG, Workstation 12.x before 12.5.8, and Fusion 8.x before 8.5.9 contain a vulnerability that could allow an authenticated VNC session to cause a stack overflow via a specific set of VNC packets. Successful exploitation of this iss...

keycloak: CSRF token fixation

It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks...

NfSen 1.3.7 / AlienVault USM/OSSIM 5.3.4 Command Injection

Exploit Title: NfSen/AlienVault remote root exploit IPC query command injection Version: NfSen 1.3.6p1, 1.3.7 and 1.3.7-1bpo80+1all. Previous versions are also likely to be affected. Version: AlienVault 5.3.4 Date: 2017-07-10 Vendor Homepage: http://nfsen.sourceforge.net/ Vendor Homepage:...

CVE-2017-2688

The integrated web server in Siemens RUGGEDCOM ROX I all versions at port 10000/TCP could allow remote attackers to perform actions with the privileges of an authenticated user, provided the targeted user has an active session and is induced into clicking on a malicious link or into visiting a...

CVE-2017-2661

It was found that pcsd was vulnerable to reflected cross-site scripting XSS attacks while handling node names during creation or import of a cluster. An attacker could use this flaw to run javascript code in an authenticated session...

CVE-2017-3837

An HTTP Packet Processing vulnerability in the Web Bridge interface of the Cisco Meeting Server CMS, formerly Acano Conferencing Server, could allow an authenticated, remote attacker to retrieve memory contents, which could lead to the disclosure of confidential information. In addition, the...

CVE-2016-9360

An issue was discovered in General Electric GE Proficy HMI/SCADA iFIX Version 5.8 SIM 13 and prior versions, Proficy HMI/SCADA CIMPLICITY Version 9.0 and prior versions, and Proficy Historian Version 6.0 and prior versions. An attacker may be able to retrieve user passwords if he or she has acces...

Session fixation

An issue was discovered in General Electric GE Proficy HMI/SCADA iFIX Version 5.8 SIM 13 and prior versions, Proficy HMI/SCADA CIMPLICITY Version 9.0 and prior versions, and Proficy Historian Version 6.0 and prior versions. An attacker may be able to retrieve user passwords if he or she has acces...

CVE-2016-9360: Insufficiently Protected Credentials

An issue was discovered in General Electric GE Proficy HMI/SCADA iFIX Version 5.8 SIM 13 and prior versions, Proficy HMI/SCADA CIMPLICITY Version 9.0 and prior versions, and Proficy Historian Version 6.0 and prior versions. An attacker may be able to retrieve user passwords if he or she has acces...

DEBIAN-CVE-2017-5367

Multiple reflected XSS vulnerabilities exist within form and link input parameters of ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, which allows a remote attacker to execute malicious scripts within an authenticated client's browser. The URL is /zm/index.php and sample...

PT-2017-8863

Name of the Vulnerable Software and Affected Versions IBM Jazz Foundation affected versions not specified Description The issue allows an authenticated user to take over a previously logged in user due to session expiration not being enforced. Recommendations At the moment, there is no informatio...

OpenSSL < 1.0.2i Default Weak 64-bit Block Cipher (SWEET32)

According to its banner, the version of OpenSSL running on the remote host is prior to 1.0.2i. It is, therefore, affected by a vulnerability, known as SWEET32, in the 3DES and Blowfish algorithms due to the use of weak 64-bit block ciphers by default. A man-in-the-middle attacker who has sufficie...

Microsoft Windows Remote Desktop Protocol Elevation of Privilege Vulnerability

Microsoft Remote Desktop Protocol RDP, Remote Desktop Protocol is an American Microsoft Microsoft company based on the Windows system in the multi-channel multi-channel protocol, it can be remotely connected to and control the server or computer. An elevation of privilege vulnerability exists in...

Management API Key Bypass

An XML API key can be bypassed if a session has been authorized. This can be used in a CSRF or XSS attack. Ref 58976 This issue requires an authenticated administrator session to be successful. This issue affects PAN-OS version 4.1.15 and earlier; 5.0.9 and earlier; 5.1.4 and earlier. Work around...

Authentication flaw

The HOT HOTBOX router with software 2.1.11 allows remote attackers to bypass authentication by configuring a source IP address that had previously been used for an authenticated session...

Cisco ISE Captive Portal Application Plaintext Credentials Exposure Vulnerability

A vulnerability in the captive portal application of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker or local, authenticated attacker to potentially gain access to the username and password of an authenticated session. The vulnerability is due to improper use of...

f-fileman 7.0 - Directory Traversal

f-fileman 7.0 - Directory Traversal Advisory: ffileman 7.0 Directory Traversal Vulnerability Credits: Raffaele Forte http://www.backbox.org Tested Versions: ffileman 7.0 Software Link: http://sourceforge.net/projects/f-fileman/ Tested on: Unix Category: Directory Traversal Severity: Medium...